On Tue, 20 Feb 2024 11:29:53 -0500 Sean Anderson <sean.ander...@seco.com> wrote:
> On 2/20/24 04:50, Benjamin Lemouzy wrote: > > Using fdtdump shows that crc32 is used as hash algorithm for FIT image > > which is a super weak one. > > I tried to pass another algo (sha256) using mkimage -o option but that > > doesn't work. > > > > ./tools/mkimage -f auto -A arm -T firmware -C none -O u-boot -a > > 0x17800000 -e 0x17800000 -p 0x0 -n "U-Boot > > 2024.04-rc2-00025-g9e00b6993f-dirty for mx6sabresd board" -E -b > > arch/arm/dts/imx6q-sabresd.dtb -b arch/arm/dts/imx6qp-sabresd.dtb -b > > arch/arm/dts/imx6dl-sabresd.dtb -d u-boot-nodtb.bin -o sha256 u-boot-dtb.img > > > > Is there any way to change U-Boot FIT image hash? > > I believe these options are only used for signed FIT images (e.g. for > verified boot [1]). Since you are using an external signing process, > they have no effect. I suggest creating your FIT manually (e.g. -f > u-boot.its instead of -f auto). You should be able to specify the hashes > manually that way. Using "fdtdump -s u-boot-dtb.img" output as reference to create a u-boot.its file, I now have a u-boot.itb file with sha256 hashes. > > I also try to use image format and force the HAB to verify the whole > > u-boot-dtb.img file by patching the FIT image size: > > > > image_size=$(stat -tc %s u-boot-dtb.img) > > printf "00000004: %08x" "$image_size" | xxd -r - u-boot-dtb.img > > > > SPL starts, authentication looks fine but the boot fails. > > Is there any chance to make it work or is it insane to try to use this > > format? > > I have always just used verified boot for U-Boot and the kernel, and > only used vendor-specific stuff for SPL. That indeed a good idea but CONFIG_SPL_FIT_SIGNATURE and CONFIG_SPL_DM (as dependency) take a lot of space and SPL overflows i.MX6 OCRAM. I finally succeed to make U-Boot check with HAB work using the new u-boot.itb image with the following signature format: ------- +-----------------------------+ <-- *load_address ^ | | | | | | | Image data | Signed | | | Data | | | | +-----------------------------+ | | Padding Next Boundary | | +-----------------------------+ <-- *ivt v | Image Vector Table | ------- +-----------------------------+ <-- *csf | | | Command Sequence File (CSF) | | | +-----------------------------+ | Padding (optional) | +-----------------------------+ I don't really understand what u-boot-dtb.img file is but it doesn't work with U-Boot CONFIG_IMX_HAB. Thanks for help! Benjamin